👷 ci: dry-run the release in the PR gate

.github/workflows/main.yml

@@ -69,10 +69,18 @@ jobs:
         uses: $/
         with:
           uv-install: 'false'
+  release:
+    name: 🏷️ Release dry run
+    uses: $/.github/workflows/prepare-release.yml
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      dry-run: true
   gate:
     name: 🚦 ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}
     if: always()
-    needs: [self-test-uvx, self-test-uv-run, self-test-external-uv]
+    needs: [self-test-uvx, self-test-uv-run, self-test-external-uv, release]
     runs-on: ubuntu-26.04
     permissions: {}
     steps:

.github/workflows/prepare-release.yml

@@ -12,16 +12,23 @@ on:
           - minor
           - patch
         default: auto
+  workflow_call:
+    inputs:
+      dry-run:
+        description: Assemble the release without pushing, for the pull request gate
+        type: boolean
+        required: true
 permissions: {}
 jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@2a3b863f4563ce9891d2cee1ed381b6f82654836 # 6.6.0
     permissions:
       contents: read
       pull-requests: read
     with:
-      bump: ${{ inputs.bump }}
+      bump: ${{ inputs.bump || 'auto' }}
+      dry-run: ${{ inputs.dry-run == true }}
       tag-prefix: v
       changelog-prefix: v
       annotated: true